The European Court of Human Rights (ECtHR) has found that the UK’s mass surveillance programmes, revealed by NSA whistleblower Edward Snowden, did not meet the quality of law requirement and were incapable of keeping the interference to what is necessary in a democratic society.

The landmark judgment marks the Court’s first ruling on UK mass surveillance programmes revealed by Mr Snowden. The case was started in 2013 by campaign groups Big Brother Watch, English PEN, Open Rights Group and computer science expert Dr Constanze Kurz following Mr Snowden’s revelation of GCHQ mass spying.

Documents provided by Mr Snowden revealed that the UK intelligence agency GCHQ were conducting population-scale interception, capturing the communications of millions of innocent people. The mass spying programmes included TEMPORA, a bulk data store of all internet traffic; KARMA POLICE, a catalogue including a web browsing profile for every visible user on the internet; and BLACK HOLE, a repository of over 1 trillion events including internet histories, email and instant messenger records, search engine queries and social media activity.

The applicants argued that the mass interception programmes infringed UK citizens’ rights to privacy protected by Article 8 of the European Convention on Human Rights as the population-level surveillance was effectively indiscriminate, without basic safeguards and oversight, and lacked a sufficient legal basis in the Regulation of Investigatory Powers Act (RIPA).

In its judgment, the ECtHR acknowledged that bulk interception is by definition untargeted ; that there was a lack of oversight of the entire selection process, and that safeguards were not sufficiently robust to provide adequate guarantees against abuse.

In particular, the Court noted concern that the intelligence services can search and examine “related communications data” apparently without restriction — data that identifies senders and recipients of communications, their location, email headers, web browsing information, IP addresses, and more. The Court expressed concern that such unrestricted snooping could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with.

The Court acknowledged the importance of applying safeguards to a surveillance regime, stating:

In view of the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there are adequate and effective guarantees against abuse.’

The Government passed the Investigatory Powers Act (IPA) in November 2016, replacing the contested RIPA powers and controversially putting mass surveillance powers on a statutory footing.

However, today’s judgment that indiscriminate spying breaches rights protected by the ECHR is likely to provoke serious questions as to the lawfulness of bulk powers in the IPA.

Jim Killock, Executive Director of Open Rights Group said:

Viewers of the BBC drama, the Bodyguard, may be shocked to know that the UK actually has the most extreme surveillance powers in a democracy. Since we brought this case in 2013, the UK has actually increased its powers to indiscriminately surveil our communications whether or not we are suspected of any criminal activity.

In light of today’s judgment, it is even clearer that these powers do not meet the criteria for proportionate surveillance and that the UK Government is continuing to breach our right to privacy.

Silkie Carlo, director of Big Brother Watch said:

This landmark judgment confirming that the UK’s mass spying breached fundamental rights vindicates Mr Snowden’s courageous whistleblowing and the tireless work of Big Brother Watch and others in our pursuit for justice.

Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public. This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over.

Antonia Byatt, director of English PEN said:

This judgment confirms that the British government’s surveillance practices have violated not only our right to privacy, but our right to freedom of expression too. Excessive surveillance discourages whistle-blowing and discourages investigative journalism. The government must now take action to guarantee our freedom to write and to read freely online.

Dr Constanze Kurz, computer scientist, internet activist and spokeswoman of the German Chaos Computer Club said:

What is at stake is the future of mass surveillance of European citizens, not only by UK secret services. The lack of accountability is not acceptable when the GCHQ penetrates Europe’s communication data with their mass surveillance techniques. We all have to demand now that our human rights and more respect of the privacy of millions of Europeans will be acknowledged by the UK government and also by all European countries.

The Court has put down a marker that the UK government does not have a free hand with the public’s communications and that in several key respects the UK’s laws and surveillance practices have failed. In particular, there needs to be much greater control over the search terms that the government is using to sift our communications. The pressure of this litigation has already contributed to some reforms in the UK and this judgment will require the UK government to look again at its practices in this most critical of areas.

High Court judges have given the UK government six months to revise parts of its Investigatory Powers Act. The government has been given a deadline of 1 November this year to make the changes to its Snooper’s Charter.Rules governing the British surveillance system must be changed quickly because they are incompatible with European laws, said the judges.

The court decision came out of legal action by human rights group Liberty. It started its legal challenge to the Act saying clauses that allow personal data to be gathered and scrutinised violated citizens’ basic rights to privacy.

The court did not agree that the Investigatory Powers Act called for a general and indiscriminate retention of data on individuals, as Liberty claimed. However in late 2017, government ministers accepted that its Act did not align with European law which only allows data to be gathered and accessed for the purposes of tackling serious crime. By contrast, the UK law would see the data gathered and held for more mundane purposes and without significant oversight.

One proposed change to tackle the problems was to create an Office for Communications Data Authorisations that would oversee requests to data from police and other organisations.

The government said it planned to revise the law by April 2019 but Friday’s ruling means it now has only six months to complete the task.

Martha Spurrier, director of Liberty, said the powers to grab data in the Act put sensitive information at huge risk.

Javier Ruiz, policy director at the Open Rights Group which campaigns on digital issues, said:

We are disappointed the court decided to narrowly focus on access to records but did not challenge the general and indiscriminate retention of communications data.

Senior police officers are to lose the power to self-authorise access to personal phone and web browsing records under a series of late changes to the snooper’s charter law proposed by ministers in an attempt to comply with a European court ruling on Britain’s mass surveillance powers.A Home Office consultation paper published on Thursday also makes clear that the 250,000 requests each year for access to personal communications data by the police and other public bodies will in future excluded for investigations into minor crimes that carry a prison sentence of less than six months.

But the government says the 2016 European court of justice (ECJ) ruling in a case brought by Labour’s deputy leader, Tom Watson , initially with David Davis, now the Brexit secretary, does not apply to the retention or acquisition of personal phone, email, web history or other communications data by national security organisations such as GCHQ, MI6 or MI5, claiming that national security is outside the scope of EU law.

The Open Rights Group has been campaigning hard on issues of liberty and privacy and writes:

This is major victory for ORG, although one with dangers. The government has conceded that independent authorisation is necessary for communications data requests, but refused to budge on retained data and is pushing ahead with the Request Filter, to enable rapid interrogation and analysis of the stored communications data.

Adding independent authorisation for communications data requests will make the police more effective, as corruption and abuse will be harder. It will improve operational effectiveness, even if less data is used during investigations and trust in the police should improve.

Nevertheless the government has disregarded many key elements of the judgment

It isn’t going to reduce the amount of data retained

It won’t notify people whose data is used during investigations

It won’t keep data within the EU, instead it will continue to transfer it, presumably specifically to the USA

The Home Office has opted for a six month sentence definition of serious crime rather than the Lords’ definition of crimes capable of sentences of at least one year.

These are clear evasions and abrogations of the judgment. The mission of the Home Office is to uphold the rule of law. By failing to do what the courts tell them, the Home Office is undermining the very essence of the rule of law.

If the Home Office won’t do what the highest courts tell it to do, why should anybody else? By picking and choosing the laws they are willing to care about, they are playing with fire.

There was one final surprise. The Code of Practice covers the operation of the Request Filter . Yet again we are told that this police search engine is a privacy safeguard. We will now run through the code in fine detail to see if any such safeguards are there. On a first glance, there are not.

If the Home Office genuinely believe the Request Filter is a benign tool, they must rewrite this section to make abundantly clear that it is not a mini version of X-Keyscore (the NSA / GCHQ’S tool to trawl their databases of people linked to their email and web visits) and does not operate as a facility to link and search the vast quantities of retained and collected communications data.

On Tuesday 7 November, three joined cases brought by civil liberties and human rights organisations challenging UK Government surveillance will be heard in the Grand Chamber of the European Court of Human Rights (ECtHR).

Big Brother Watch and Others v UK will be heard alongside 10 Human Rights Organisations and Others v UK and the Bureau of Investigative Journalism and Alice Ross v UK, four years after the initial application to the ECtHR.

Big Brother Watch, English PEN, Open Rights Group and Dr Constanze Kurz made their application to the Court in 2013 following Edward Snowden’s revelations that UK intelligence agencies were running a mass surveillance and bulk communications interception programme, TEMPORA, as well as receiving data from similar US programmes, PRISM and UPSTREAM, interfering with UK citizens’ right to privacy.

The case questions the legality of the indiscriminate surveillance of UK citizens and the bulk collection of their personal information and communications by UK intelligence agencies under the Regulation of Investigatory Powers Act (RIPA). The UK surveillance regime under RIPA was untargeted, meaning that UK citizens’ personal communications and information was collected at random without any element of suspicion or evidence of wrongdoing, and this regime was effective indefinitely.

The surveillance regime is being challenged on the grounds that there was no sufficient legal basis, no accountability, and no adequate oversight of these programmes, and as a result infringed UK citizens’ Article 8 right to a private life.

In 2014, the Bureau of Investigative Journalism made an application to the ECtHR, followed by 10 Human Rights Organisations and others in 2015 after they received a judgment from the UK Investigatory Powers Tribunal. All three cases were joined together, and the Court exceptionally decided that there would be a hearing.

The result of these three cases has the potential to impact the current UK surveillance regime under the Investigatory Powers Act. This legal framework has already been strongly criticized by the Court of Justice of the European Union in Watson . A favourable judgment in this case will finally push the UK Government to constrain these wide-ranging surveillance powers, implement greater judicial control and introduce greater protection such as notifying citizens that they have been put under surveillance.

Historically, it has required a ruling from this Court before improvements in domestic law in this area are made. Edward Snowden broke that cycle by setting in motion last year’s Investigatory Power Act, but my clients are asking the Court to limit bulk interception powers in a much more meaningful way and to require significant improvements in how such intrusive powers are controlled and reported.

UK citizens who are not suspected of any wrongdoing should be able to live their lives in both the physical and the digital world safely and securely without such Government intrusion.

If the Court finds that the UK Government infringed UK citizens’ right to privacy, this should put further pressure on the Government to implement measures to ensure that its current surveillance regime doesn’t make the same mistakes.

Antonia Byatt, Interim Director of English PEN, said:

More than four years since Edward Snowden’s revelations and nearly one year since the Investigatory Powers Act was passed, this is a landmark hearing that seeks to safeguard our privacy and our right to freedom of expression.

The UK now has the most repressive surveillance legislation of any western democracy, this is a vital opportunity to challenge the unprecedented erosion of our private lives and liberty to communicate.

Jim Killock, Executive Director of Open Rights Group, said:

Mass surveillance must end. Our democratic values are threatened by the fact of pervasive, constant state surveillance. This case gives the court the opportunity to rein it back, and to show the British Government that there are clear limits. Hoovering everything up and failing to explain what you are doing is not acceptable.

Among the many unpleasant things in the Investigatory Powers Act that was officially signed into law this week, one that has not gained as much attention is the apparent ability for the UK government to undermine encryption and demand surveillance backdoors.As the bill was passing through Parliament, several organizations noted their alarm at section 217 which obliged ISPs, telcos and other communications providers to let the government know in advance of any new products and services being deployed and allow the government to demand technical changes to software and systems.

Communications Service Providers (CSP) subject to a technical capacity notice must notify the Government of new products and services in advance of their launch, in order to allow consideration of whether it is necessary and proportionate to require the CSP to provide a technical capability on the new service.

As per the final wording of the law, comms providers on the receiving end of a technical capacity notice will be obliged to do various things on demand for government snoops — such as disclosing details of any system upgrades and removing electronic protection on encrypted communications.

The UK government has introduced an amendment to the Investigatory Powers Bill currently going through Parliament, to make ensure that data retention orders cannot require ISPs to collect and retain third party data. The Home Office had previously said that they didn’t need powers to force ISPs to collect third party data, but until now refused to provide guarantees in law.Third party data is defined as communications data (sender, receiver, date, time etc) for messages sent within a website as opposed to messages sent by more direct methods such as email. It is obviously a bit tricky for ISPs to try and decode what is going on within websites as messaging data formats are generally proprietary, and in the general case, simply not de-cypherable by ISPs.

The Government will therefore snoop on messages sent, for example via Facebook, by demanding the communication details from Facebook themselves.

The Haystack is a new documentary , released today by Scenes of Reason , bringing together leading lights for and against the UK’s Investigatory Powers Bill. This unprecedented piece of legislation, which is now under parliamentary scrutiny, seeks to affirm and expand the surveillance remit of UK security services and other departments, including new powers for the police to access internet connection records — a database of the public’s online activity over the previous 12 months.

The film provides an excellent roundup of arguments on both sides of the tortuous surveillance debate, including Conservative MP Johnny Mercer echoing the well-worn refrain, if you have nothing to hide, you have nothing to fear. Jim Killock of the Open Rights Group , speaking at the film’s launch, quipped that Mr Mercer might feel a bit different if it were the left-wing government of Jeremy Corbyn and John McDonnell wielding these powers. Indeed, as far-right parties attract support around Europe and the world, the likelihood increases of tremendous state surveillance becoming the plaything of ever more abusive regimes.

The immense capabilities contained within the bill are unpalatable in the hands of any authority — they are all too easily harnessed to undermine perfectly reasonable political opposition and judicial work. By way of example, the film outlines one such case where the current UK government improperly gained access to privileged details of a court case against it. In this light, the bill seems an intolerable threat to democracy and free expression.

Voices of concern from the security community , such as Sir David Omand, ex-GCHQ chief, explain that precautions against terrorism require more spying. Others reject this, noting that security services have failed to act on intelligence when they do have it — spending enormous sums on digital surveillance only reduces their efficacy in the realm of traditional detective work. Moreover, those costs, to be borne by government and industry, are excessive at a time of cuts to other public services designed to protect us from more conventional enemies, such as disease.